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• (TS//SI//NF) Recognize how BR and PR/TT authorities t 
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(TS//SI//NF) (OGC Attorney): Throughout the 
procedures NSA has implemented to provide 
the work roles that are involved across the Er 

(TS//SI//NF) (HMC Character): This part of oi 
in support of the BR and PR/TT Bulk Metadat 
This module will enable you to: 

. (TS//SI//NF) Identify how BR and PR 
• (TS//SI//NF) Recognize how BR and 


first five modules of our course, we have discussed the BR and PR/TT Orders and the policies and 
reasonable assurance of compliance with the Orders. We also have looked at the community of people and 
iterprise to support that aspect of the mission. 

r trip is designed specifically for anyone working in an analytical role, or supervising staff in an analytical role, 
a Programs. In particular we will discuss facets of BR and PR/TT that are of interest to analysts and HMCs. 

TT fit into the analytic workflow 

PR/TT authorities apply to real-life scenarios 
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(TS//SI//NF) (Display introductory 
images/graphics pertinent to the Zazi 
story). 

(TS//SI//NF) Graphic showing the portfolio 
of CT authorities with BR and PR/TT 
highlighted. Possible video footage of the 
arrest. 


(TS//SI//NF) (HMC Character): In Module 1, 
leverage multiple authorities and tools. CT t< 
focus of the BR and PR/TT Programs, NSA 

(TS//SI//NF) To illustrate how these various 
analytic workflow, we’ll step through the exa 


we mentioned that in order to gain comprehensive insight into a target’s activities, it is often necessary to 
argets have maintained an ongoing desire to conduct attacks within the United States. Given the unique U.S.- 
s able to fill collection gaps left by our other authorities. 

authorities can complement each other to fill critical gaps, as well as to show how BR and PR/TT fit into the 
mple of Najibullah Zazi and the New York subway plot. 
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( TS//S I //NF ) Graphic showing the portfolio 
of CT authorities with BR and PR/TT 
highlighted 



( TS//S I //NF ) (HMC Character ): ^^^^^^^^^^^^^^^^^^^^KCTan alysts discovered a Pakistan-based email address associated with | 

operations the analysts 

tasked the address to FAA 702 and reviewed the subsequent traffic on a regular basis. 



( TS//S I //NF ) In Fall of 2009, one particular piece of content collection obtained from FAA 702 revealed an email exchange between a Pakistan-based target 
and an unknown individual suggesting that an unspecified terrorist operation was about to take place. Within this email, the analyst also discovered what 
appeared to be a U.S. -based phone number that was missing the country jcode^ 



Comment [al]: Graphic of 2 terrorists sending 
email to each other, show email indicating threat and 
containing a number without country code 
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NSA reported the suspicious activity and minimized U.S. phone number in a standard EGRAM. After 
receiving the unminimized U.S. phone number through NSA’s Identity Release process, the FBI learned that the user of the unknown email address and _ 
owner of the phone number was a Colorado-based individual named Najibuilah Zazi. FBI immediately started an investigation into Zazi’s activities^ 



CommentTa2]: Maybe show report or something 
similar send serial numbers 
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(TS//SI//NF) 




HJ.S. person Najibullah Zazi is the user off 

\According to SIGINT reporting 

I a Pakistan-based al-Qa'ida (AQ) facilitator, ^ 

I received an emalftrom Naiibullah Zazi on 6 




ohone number. 



(U) Show graphic of the RAS equation 
here. 

( TS//S I //NF ) Graphic showing the portfolio 
of CT authorities with BR and PR/TT 
highlighted 

(U) Highlight the important parts of the 

statement 

( TS//S I //NF ) (HMC Character): Simultaneously, to gain a fuller picture of Zazi’s contacts, an NSA CT analyst submitted a RAS-approval reques t to an HMC 
on Zazi’s phone number and email address. Recall from Module 3 that, in order to meet the RAS standard, an identifier must be tied to specificMT 

In this case, the analyst met the RAS standarcMD^DasincOh^ustffi cation on the fact that Zazi was in direct 
communication with the Pakistan-based email address used by a member of ^^^^^^^^^^^^^Because Zazi is a U.S. person, after the RAS 
requests on Zazi’s identifiers were reviewed by an HMC, they were then sent to OGC, who performed a First Amendment review and gave the final 
[approval. 



( TS//S I //NF ) When considering RAS, analysts should remember to include just the basic facts needed with supporting documentation, as was done in 
Zazi case, and not clutter the justification with excess information or documentation. 



Comment [a3]: Graphic of RAS template 

Comment [chr4]: With the RAS ‘template’ are 
we going to pull up the key items in text bubbles or a 
‘cloud’ ala the rainbow slide presentation? 
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highlighted 

(U) Use screen shots to illustrate main 
points 



( TS//S I //NF ) (HMC Character): After the RAS requests were approved, using the BR and PR/TT modes of | 

metadata queries on the approved identifiers , as we discussed in Module 4. Th e analyst querying Zazfs_Coloradoj 
the time that Zazi exchanged emails with the he had also contacted | 

guidance that we discussed in Module 4, the analyst determined that Zazi’s contacts with these 
this uniqueness, the analyst began drafting a report in accordance with the dissemination guidel" 
released, the Chief of SI 2 determined that the report met the CT Nexus criteria and approved its release^ 




CT analysts began running federated 
hone number discovered that around 
hone numbers. Using the 



lumbers were unique to BR metadata. Based on 
we reviewed in Module 4. Before the report was 



Comment [a5]: Use one of screenshots showing 
what a chain/query looks like 



(TS//S I //NF) Remember, even “fact of’ statements describing what BR- or PR/TT-unique data was discovered are considered “query results” under FISC 
guidelines an d must be handled in accordance with the Court Orders. Plowever, once formally disseminated to customers, it no longer requires the 
MBK Uprotection and is treated as normal SIGINT analysis, as is the case with the example we have just described. 
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(U) Use screen shots to illustrate main 
points 
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(U) Knowledge Check 

1. (TS//SI//NF) In the Zazi scenario, analysts used E.O. 12333 and FAA 702 collection to support RAS. 
Which source(s) can be used to support RAS? 
a) (U) FBI reporting 
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b) (U) Open sc 

c) (TS//SI//NF 

d) (U) All the 
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NSA FISA collection 
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y was the RAS request for Zazi sent to OGC for a First Amendment review? 
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b) (TS//SI//NF) Zazi is a U.S. person 

c) (TS//SI//NF) Zazi is a member of al-Qa’ida or an associated terrorist group 

d) (TS//SI//NF) The RAS determination was a close call 




GRAPHIC/AV: 


(U) (HMC Character): Let’s make a few notes 


in our travel journal and check to see what you remember from this topic! 


Question 1. (U//FOUO) Correct! Any information that is lawfully in our possession may be used to support a RAS determination. 

(U//FOUO) Incorrect, the correct answer is d). Any information that is lawfully in our possession may be used to support a RAS determination. 

Question 2. (U//FOUO) Correct! A First Amendment review is only necessary when the identifier is believed to belong to a U.S. person. 

(U//FOUO) Incorrect, the correct answer is b). A First Amendment review is only necessary when the identifier is believed to belong to a U.S. person. 
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3) ( TS//S I //NF ) In this scenario, information was discovered that was unique to the BR authority. If that same 
information had also been discovered in E.O. 12333 collection, a CT Nexus determination would still need to 
be made in order to disseminate that information because the information was in the BR repository. 

a) (U) True 

b) (U) False 
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ALT TAG: 



4) ( TS//S I //NF ) Why are students without^^^^^^J allowed to learn that Zazi had contact with other New 
York numbers? 

a) ( TS//S I //NF ) That information is not specific enough to qualify as 

b) ( TS//S I //NF ) The information is over one year old 

c) (TS//S I //NF ) The information has been previously disseminated outside of NSA 

d) ( TS//S I //NF ) It is being shared for training purposes 



GRAPHIC/AV: 



(No audio or transcript on this page) 



Question 3. ( TS//S I //NF ) Correct! If the same information is discovered through another source, neither the BR nor PR/TT rules and requirements apply. 
( TS//S I //NF ) Incorrect. The correct answer is b) (False). Neither the BR nor PR/TT rules and requirements apply if the same information is discovered 
through another source. 

Question 4. ( TS//S I //NF ) Correct! The information can be disclosed to those without because it has previously been disseminated outside 

of NSA. 

( TS//S I //NF ) Incorrect. The correct answer is c). The information can be disclosed to those without ^^^^^^^^|only because it has previously been 
disseminated outside of NSA. 
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(U) Practice Scenario 1 



( TS//S I //NF ) You are a cleared analyst who, through PR/TT metadata analysis of seeds associated 
with a high value CT target, has identified a PR/TT-unique direct contact - email address^^^^^^B^^H^^H 
believed to be used by someone ii^^mei^fo^i^io^ure whether the identifier warrants further development as 
a target, but to find out you place in a tasking database to enable content collection from 

E.O. 12333 sources. This tasking aatabas^^viael^vailable to all intelligence analysts in the SIGINT Production 
Chain. For this reason, you note in the comments field that this identifier was discovered through metadata analysis 
and is believed to be a direct contact of the high value CT target, but you deliberately avoid identifying the PR/TT 
metadata as the source of the identifier. Are your actions in compliance with the terms of the PR/TT Orders? 

(U) Please select the your answer: 

a) ( TS//S I //NF ) Yes, because you did not include the reference to PR/TT. 

b) ( TS//S I //NF ) No, because you failed to mark the source of the identifier as PR/TT metadata. 

c) (TS//S I //NF ) Yes, because the results will be governed under E.O. 12333 rules and procedures. 

d) (TS//SI//NF) No, because you have shared a PR/TT-unique q uej^^SliJ^ii!! a wide audience 
of intelligence analysts, many of whom do not hold current ^^^^^^^^Hrredentials. 



(U) (FIMC Character): Now let’s practice what we have learned using a real-life scenario. Carefully read the scenario and then select the best answer. 



ANSWER: 

a) ( TS//S I //NF ) Incorrect. The correct answer is d). No, because you have shared a PR/TT-unique query result with a wide audience of intelligence 
analysts, many of whom do not hold current ^^^^^^^^^redentials. 

b) (TS//S I //NF ) Incorrect. The correct answer is d). No, because you have shared a PR/TT-unique query result with a wide audience of intelligence 
analysts, many of whom do not hold current ^^^^^^^Hcredentials. 

c) ( TS//S I //NF ) Incorrect. The correct answer is d). No, because you have shared a PR/TT-unique query result with a wide audience of intelligence 

analysts, many of whom do not hold current credentials. 

d) (TS//S I //NF ) Correct! The right answer is d). No, because you have shared a PR/TT-unique query result with a wide audience of 
intelligence analysts, many of whom do not hold current ^^^^^^^^|credentials. 
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(U //FOUO ) You should now be able to: 



• (TS//S I //NF ) Identify how BR and PR/TT fit into the analytic workflow 

• (TS//S I //NF ) Practice applying BR and PR/TT authorities in real-life scenarios 

TS//S I//NF) If you have questions or wish to find out more, please contact youi 
leared manager or any of the following BR or PR/TT points of contact: 



OGC email alias: DL gc_ops 

OGC Phone:^^^^^|or 963-3121 (s) 

OGC website: go GC 



HMCs email alias: DL CT_HMC 

SID Oversight and Compliance email alias: DL SV42_all 



(U //FOUO ) (FIMC Character): Now that we have completed this part of our road trip, you should be able to: 

• ( TS//S I //NF ) Identify how BR and PR/TT fit into the analytic workflow 

• ( TS//S I //NF ) Practice applying BR and PR/TT authorities in a real-life scenario 



( TS//S I //NF ) (FIMC Character): You are encouraged to reach out to your^^^^^^^^|cleared manager or any of the points of contact listed here if you 
have any questions or if you want to find out more. Please remember that it is critical to our mission that we are 100% compliant with the requirements in 
the Court Orders especially with regards to collaborating, sharing, and disseminating this data through the course of your analysis work. You may review 
this course at any time and seek guidance from any of the points of contact listed here. 
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(U) You will view the questions in a separate Assessment Questions Document 

(U) You will enter your responses in a separate QuestionMark online answer sheet 

(U) You will have only one attempt to successfully complete the assessment 

(U) Allow yourself sufficient time (approximately 30 minutes) to complete the assessment 



(U) To Complete the Assessment: 



• (U) Click the link to open the Assessment Questions DocumWtit 

• (U) Go to the VUport SumTotal Content Player page, click on the Assessment link, and follow the 
instructions to complete the required exam 



(U //FOUO ) (OGC Attorney): The final part of your trip will be to successfully complete the assessment for the course. Please be aware that for the 
assessment you will view the questions in a .pdf file and enter your responses in a separate QuestionMark online answer sheet. Please be sure that you 
open the .pdf with the questions first before opening the QuestionMark online answer sheet. You will have one attempt to complete the assessment. Please 
allow yourself sufficient time (approximately 30 minutes) to complete the assessment. 

(U //FOUO ) Please click the Assessment Questions Document link to open the .pdf question file and keep the window open. Then go to the VUport 
SumTotal Content Player page, click on the Assessment link on the left, and follow the instructions to complete the required exam. 



Comment [SLS6]: Please make this a link that 
will open the Assessment Question pdf for 
Analytical Personnel (we will actually connect the 
link later). 
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